Privacy policy

01Who is responsible

Moxunos is operated by NRD Software, a sole proprietorship registered in Denmark. NRD Software is the data controller for the personal data described in this policy.

Contact us at support@moxunos.com.

02What we store

• Account data: your email address, username and password hash. We use Argon2id and never store your password in plain text.
• Country: a two-letter country code used for regional availability. At sign-up, our server uses your IP address to find the country and keeps only the country code. If the lookup fails, Denmark is selected by default. You can change it in the app.
• Your services: the streaming services and plan levels you add. Moxunos does not connect to your streaming accounts.
• Social data: friendships, friend codes, party invitations and notification settings.
• Lists and choices: watchlist entries, watched titles and availability reports you submit.
• Watch parties: the room, its members, the title and service in use once the party has picked one, and whether the host has opened the room to friends. Title suggestions and votes live only in the room while it is open and are not written to disk. Empty rooms close automatically.

03Live data we do not keep

• Playback commands: play, pause and seek positions are relayed between room members and kept in memory only while the room is active. We do not create a viewing history from them.
• Chat: messages are delivered to the people currently in the room and are not written to disk. The one exception: if you report a message, that single message is saved so our team can review it (see section 11).
• Voice chat: your microphone audio is sent between participants and is not recorded or stored by Moxunos. See section 7.
• IP addresses: our server processes IP addresses to deliver connections, prevent abuse and rate-limit login attempts. They are not stored in the product database or used for advertising or profiling.

04What we do not collect

• Passwords or viewing histories from Netflix, Disney+ or any other streaming provider.
• Advertising identifiers or third-party analytics. YouTube receives data only if you choose to play a trailer, as explained below.
• Personal data for sale. We do not sell or rent personal data.

05Cookies

Moxunos uses one strictly necessary session cookie to keep you signed in. It is used only for authentication, not for advertising or tracking, and does not require consent.

06Trailers

Trailers use YouTube's privacy-enhanced player. Nothing is sent to YouTube until you choose to play a trailer. From that point, YouTube handles the request under Google's privacy policy.

07Voice chat in a room

Voice chat lets you talk while you watch. When you join it, your browser first asks your permission to use your microphone. Your audio then travels directly between the participants (peer-to-peer): it does not pass through our server, and we neither hear nor record it.

Setting up those direct connections needs a little help. Browsers use a STUN server to discover each other's network address — that server sees your IP address, which is the whole point of it. On the minority of networks where a direct link isn't possible, an encrypted relay (TURN) server carries the audio instead; it stays encrypted between the participants and is never written to disk. Who operates these connection servers is described under Service providers.

You can mute yourself at any time, and leaving voice releases your microphone immediately. People in the room could still record with tools outside Moxunos, so only speak with those you trust. Video chat is not part of Moxunos yet.

08The browser extension

The extension synchronises playback. It uses a one-time room ticket that expires after one minute and does not read or store your Moxunos session cookie. It sends playback commands and, for the host, the address of the selected title to Moxunos. It does not read your general browsing history or collect page content.

09Why we process data

We process account and feature data because it is necessary to provide the service you request (GDPR Article 6(1)(b)). We process transient connection data to secure the service and prevent abuse, based on our legitimate interest in operating a safe service (Article 6(1)(f)).

10Service providers and data sources

• Hetzner Online GmbH in Germany hosts Moxunos. Product data is stored in the EU.
• Plus Five Five, Inc. (Resend) in the United States sends account verification and password-reset emails. It receives the email address and message content. Resend's data processing agreement includes the EU Standard Contractual Clauses for international transfers.
• TMDB provides the title and availability information behind Moxunos. We fetch that information from our own server, so your identity and IP address are not sent to TMDB when we look it up. Posters and other title images are a separate case: your browser loads them directly from TMDB's image server (image.tmdb.org), which — like any host of an image on a web page — receives your IP address in the process. Some of the underlying availability data is supplied by JustWatch.
• Voice-chat connection servers. When you use voice chat, a STUN server helps your browser and the other participants find each other, and — only where a direct connection isn't possible — an encrypted relay (TURN) server passes the audio along. We run these servers ourselves, on our own machine in the EU (Hetzner), so no third party is involved in setting up the call. Such a server sees your IP address to do its job; the audio itself always stays between the participants (see section 7).

See Data & credits for more about the catalog sources used by Moxunos.

11How long we keep data

• Account data: until you delete your account. Deletion removes the account and related product data from active systems.
• Backups: encrypted server backups are retained for up to 14 days. Deleted data disappears as those backups expire.
• Account links: email verification links expire after 24 hours and password-reset links after one hour.
• Live rooms: chat is not stored, and empty watch parties close automatically.
• Reported messages: when someone reports a chat message, we keep a copy of that message — with who sent it and who reported it — so we can act on abuse. We remove it once the report is resolved.

12Your rights

Depending on the circumstances, the GDPR gives you the right to access, correct or delete your personal data; restrict or object to its use; and receive data you provided in a portable format.

You can delete your account in Moxunos. For any other request, email support@moxunos.com. We respond without undue delay and normally within one month.

If you believe your data has been handled unlawfully, you may also complain to Datatilsynet, the Danish Data Protection Agency.

13Changes to this policy

We will update the date at the top when this policy changes. If a change materially affects how we use personal data, we will also provide a clear notice in Moxunos or by email.